From 22b8d9133fd753453c783a2d90bdcc5059092d09 Mon Sep 17 00:00:00 2001 From: wenyuzifang Date: Tue, 28 Oct 2025 19:02:20 +0800 Subject: [PATCH] Update code from upstream --- usermode-1.114-fixfree.patch | 163 +++++++++++++++++++++++++++++++++ usermode-1.114-fixnoargs.patch | 16 ++++ usermode.spec | 17 +++- 3 files changed, 192 insertions(+), 4 deletions(-) create mode 100644 usermode-1.114-fixfree.patch create mode 100644 usermode-1.114-fixnoargs.patch diff --git a/usermode-1.114-fixfree.patch b/usermode-1.114-fixfree.patch new file mode 100644 index 0000000..387aab9 --- /dev/null +++ b/usermode-1.114-fixfree.patch @@ -0,0 +1,163 @@ +diff -up usermode-1.114/userhelper.c.fixfree usermode-1.114/userhelper.c +--- usermode-1.114/userhelper.c.fixfree 2025-01-23 23:33:24.778721387 +0100 ++++ usermode-1.114/userhelper.c 2025-01-23 23:57:54.375799100 +0100 +@@ -1749,7 +1755,6 @@ wrap(const char *user, const char *progr + displaying any unwanted GUI dialogs. */ + retval = pipe_conv_exec_start(data); + if (retval != 0) { +- g_strfreev(environ); + environ = environ_save; + die(data, retval); + } +@@ -1802,7 +1808,6 @@ wrap(const char *user, const char *progr + /* Nope, not there, either. */ + debug_msg("userhelper: couldn't find wrapped " + "binary\n"); +- g_strfreev(environ); + environ = environ_save; + die(data, ERR_NO_PROGRAM); + } +@@ -1837,7 +1843,6 @@ wrap(const char *user, const char *progr + #ifdef HAVE_FEXECVE + close(fd); + #endif +- g_strfreev(environ); + environ = environ_save; + die(data, ERR_NO_USER); + } +@@ -1934,7 +1940,6 @@ wrap(const char *user, const char *progr + #ifdef HAVE_FEXECVE + close(fd); + #endif +- g_strfreev(environ); + environ = environ_save; + fail_exit(data, retval); + } +@@ -1957,7 +1963,6 @@ wrap(const char *user, const char *progr + #ifdef HAVE_FEXECVE + close(fd); + #endif +- g_strfreev(environ); + environ = environ_save; + fail_exit(data, retval); + } else +@@ -1965,7 +1971,6 @@ wrap(const char *user, const char *progr + /* Reset the user's environment so that the + * application can run normally. */ + argv[optind - 1] = strdup(program); +- g_strfreev(environ); + environ = environ_save; + become_normal(data, user); + if (data->input != NULL) { +@@ -2008,7 +2014,6 @@ wrap(const char *user, const char *progr + #ifdef HAVE_FEXECVE + close(fd); + #endif +- g_strfreev(environ); + environ = environ_save; + fail_exit(data, retval); + } +@@ -2022,7 +2028,6 @@ wrap(const char *user, const char *progr + close(fd); + #endif + pam_end(data->pamh, retval); +- g_strfreev(environ); + environ = environ_save; + fail_exit(data, retval); + } +@@ -2030,7 +2036,6 @@ wrap(const char *user, const char *progr + #ifdef HAVE_FEXECVE + close(fd); + #endif +- g_strfreev(environ); + environ = environ_save; + die(data, ERR_UNK_ERROR); + } +@@ -2043,7 +2049,6 @@ wrap(const char *user, const char *progr + close(fd); + #endif + pam_end(data->pamh, retval); +- g_strfreev(environ); + environ = environ_save; + fail_exit(data, retval); + } +@@ -2056,7 +2062,6 @@ wrap(const char *user, const char *progr + #ifdef HAVE_FEXECVE + close(fd); + #endif +- g_strfreev(environ); + environ = environ_save; + die(data, ERR_NO_USER); + } +@@ -2081,7 +2087,6 @@ wrap(const char *user, const char *progr + close(fd); + #endif + pam_end(data->pamh, retval); +- g_strfreev(environ); + environ = environ_save; + fail_exit(data, retval); + } +@@ -2094,7 +2100,6 @@ wrap(const char *user, const char *progr + close(fd); + #endif + pam_end(data->pamh, retval); +- g_strfreev(environ); + environ = environ_save; + fail_exit(data, retval); + } +@@ -2105,7 +2111,6 @@ wrap(const char *user, const char *progr + #ifdef HAVE_FEXECVE + close(fd); + #endif +- g_strfreev(environ); + environ = environ_save; + die(data, ERR_EXEC_FAILED); + } +@@ -2143,7 +2149,6 @@ wrap(const char *user, const char *progr + #ifdef HAVE_FEXECVE + close(fd); + #endif +- g_strfreev(environ); + environ = environ_save; + die(data, retval); + } +@@ -2175,7 +2181,6 @@ wrap(const char *user, const char *progr + cmdline, user, strerror(errno)); + if (data->output != NULL) + pipe_conv_exec_fail(data); +- g_strfreev(environ); + environ = environ_save; + die(data, ERR_EXEC_FAILED); + } +@@ -2197,7 +2203,6 @@ wrap(const char *user, const char *progr + #ifdef HAVE_FEXECVE + close(fd); + #endif +- g_strfreev(environ); + environ = environ_save; + fail_exit(data, retval); + } +@@ -2207,7 +2213,6 @@ wrap(const char *user, const char *progr + #ifdef HAVE_FEXECVE + close(fd); + #endif +- g_strfreev(environ); + environ = environ_save; + if (WIFEXITED(status)) + exit(WEXITSTATUS(status)); +@@ -2241,7 +2247,6 @@ wrap(const char *user, const char *progr + #ifdef HAVE_FEXECVE + close(fd); + #endif +- g_strfreev(environ); + environ = environ_save; + die(data, retval); + } +@@ -2270,7 +2276,6 @@ wrap(const char *user, const char *progr + "root privileges on behalf of '%s': %s", + cmdline, user, strerror(errno)); + pipe_conv_exec_fail(data); +- g_strfreev(environ); + environ = environ_save; + die(data, ERR_EXEC_FAILED); + } diff --git a/usermode-1.114-fixnoargs.patch b/usermode-1.114-fixnoargs.patch new file mode 100644 index 0000000..9c8a7e2 --- /dev/null +++ b/usermode-1.114-fixnoargs.patch @@ -0,0 +1,16 @@ +diff -up usermode-1.114-build/usermode-1.114/userhelper.c.fixnoargs usermode-1.114-build/usermode-1.114/userhelper.c +--- usermode-1.114-build/usermode-1.114/userhelper.c.fixnoargs 2025-07-09 00:13:58.800352637 +0200 ++++ usermode-1.114-build/usermode-1.114/userhelper.c 2025-07-09 00:13:58.814677097 +0200 +@@ -2397,6 +2397,12 @@ main(int argc, char **argv) + exit(ERR_INVALID_CALL); + } + ++ if (!SHELL_FLAGS && !c_flag && !w_flag) { ++ debug_msg("userhelper: invalid call: " ++ "missing action argument\n"); ++ exit(ERR_INVALID_CALL); ++ } ++ + /* Determine which conversation function to use. */ + if (t_flag) { + /* We were told to use text mode. */ diff --git a/usermode.spec b/usermode.spec index 74e5e08..d4ebdef 100644 --- a/usermode.spec +++ b/usermode.spec @@ -1,18 +1,24 @@ -%define anolis_release 1 +%define anolis_release 2 %global _hardened_build 1 Name: usermode Summary: Tools for certain user account management tasks -Version: 1.114 +Version: 1.114 Release: %{anolis_release}%{?dist} License: GPLv2+ URL: https://pagure.io/%{name}/ -Source0: https://releases.pagure.org/%{name}/%{name}-%{version}.tar.xz -Source1: config-util +Source0: https://releases.pagure.org/usermode/usermode-1.114.tar.xz +Source1: config-util +Patch1: usermode-1.114-fixfree.patch +Patch2: usermode-1.114-fixnoargs.patch BuildRequires: make gcc gettext, glib2-devel, intltool BuildRequires: libblkid-devel, libselinux-devel, libuser-devel BuildRequires: pam-devel, perl-XML-Parser util-linux +BuildRequires: desktop-file-utils +BuildRequires: gtk2-devel +BuildRequires: libSM-devel +BuildRequires: startup-notification-devel Requires: pam, passwd, util-linux @@ -58,5 +64,8 @@ install -p -m 644 %{SOURCE1} \ %doc ChangeLog NEWS README %changelog +* Tue Oct 28 2025 wenyuzifang - 1.114-2 +- Prevent memory corruption by removing unsafe environment freeing in error paths. +- Enforce valid usage by requiring an action flag to prevent undefined behavior and improve security. * Fri Apr 21 2023 happy_orange - 1.114-1 - init package -- Gitee